Microsoft Entra ID Security Updates: Key 2026 Changes
Summary
Microsoft is making three important Microsoft Entra ID security changes in 2026: retiring Custom controls in favor of External MFA, enforcing Conditional Access more consistently during credential registration, and requiring explicitly registered authentication methods for SSPR. These updates matter because they close policy enforcement gaps, improve identity security, and require admins to review configurations before enforcement deadlines arrive.
Introduction
Microsoft is tightening Microsoft Entra ID security in several areas that directly affect authentication, Conditional Access, and self-service password reset. For IT admins, these changes are important because they remove legacy behavior, close enforcement gaps, and require preparation ahead of hard deadlines in 2026.
What’s new in Microsoft Entra ID
1. Custom controls are being deprecated
Microsoft is retiring Custom controls and steering organizations to External MFA for third-party MFA integrations in Conditional Access.
- Existing Custom controls will keep working during the transition period
- Retirement date: September 30, 2026
- End of life: May 2027
- External MFA offers deeper integration and a more modern, standards-based approach
If your organization still relies on Custom controls, migration planning should start now.
2. Conditional Access will apply consistently during credential registration
Starting the week of July 6, 2026, Conditional Access policies targeting the Register security information action will also apply to:
- Windows Hello for Business provisioning
- macOS Platform Single Sign-on registration
This closes a long-standing gap where some registration experiences were not governed by the same Conditional Access rules used elsewhere. Users who do not meet policy requirements may see additional prompts during setup or registration.
3. SSPR will require registered authentication methods
Microsoft is changing self-service password reset (SSPR) so only explicitly registered authentication methods can be used.
- Registration campaign starts: July 6, 2026
- Enforcement begins: September 7, 2026
- Directory-based phone numbers or email addresses that were never formally registered will no longer work for SSPR verification
This aligns password reset with stronger proof-of-possession and user-verified authentication methods.
Impact on IT administrators
These changes could affect onboarding, device setup, password reset success rates, and third-party MFA integrations. Organizations that do not prepare may see user friction, help desk volume increases, or unsupported legacy configurations as enforcement dates approach.
What admins should do now
- Inventory any Custom controls dependencies
- Review External MFA migration requirements
- Test registration-related Conditional Access policies in report-only mode
- Validate Windows Hello for Business and macOS registration scenarios
- Audit SSPR readiness and identify users relying on unregistered directory values
- Communicate upcoming registration prompts and deadlines to users and support teams
The main takeaway: review your Entra ID authentication and access policies now so these 2026 security changes do not disrupt users later.
Need help with Entra ID?
Our experts can help you implement and optimize your Microsoft solutions.
Talk to an ExpertStay updated on Microsoft technologies